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(b)(3) - P.L. 86-36 
(b) (6) 


I. (U) SUMMARY 

1(b)(3) - P.L. 86-36| 


(U//F6hlO^ This investigation 1 was condu cted in response to a.referral alleging that 
I '■ ~~--L nited States Navy (llSN), while deployed 

with United States Forces- 1 Iraq (USFI), queried a telephone number belonging to a 
U. S. person through the.SlGINT "system without authorization. 

(U//FOUO) A local audit of the SIGINT system revealed that | fa ueried 

a telephon e number'belon ging to a U. S. person on 4 Ju ne 2011. The aue rV-was m ade 

through t hej_jsys tent.whilel |was assigned to thel 1 

| \ | The query 

sought data from 5 May to 4 June 2011. No information was retrieved as a result of 
this query due to system safeguards.- An NSA/CSS Intelligence-Related Incident 
Report was completed by a local system auditor and provided to the NSA/CSS 
Signals Intelligence Directorate Oversight and Compliance office and to the 
NSA/CSS Office of the Inspector General (OIG). This matter was investigated by the 
OIG and the Navy Criminal Investigative Service. 


(U//FOUO) The OIG concluded that | *| deliberately and without 

authorization queried a telephone number belonging to a U.S. person. Her actions 
violated Executive Order 12333, USSID 18,5 C.F.R. §2635.704, and Department of 
Defense Regulation 5240.1-R, Procedures 2 & 14. A Navy Criminal Investigative 
Service investigation is pending. 


(U) Copies of the OIG report will be provided to the NSA/CSS Associate 
Directorate for Security and Counter Intelligence, the NSA/CSS Office of General 
Counsel and NCIS for review and appropriate action. 
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II. (U) BACKGROUND 


(U) Introduction 


(b)(3) - P.L. 86-36 


(b) (6) 



(U//FOUO) On 9 July 2011 a loc al audit of the SIGINT system 
was cond ucted ad ]This audit discovered that on 4 


.Iune-201-1 




|(b) (3) - P.L. 86-361 


I queried a telephone n umber belongin g to 
a U.S. person. Tile query was made th rough the I | 

; which uses th ej | database. 

(U//F000} The j ~ "l ate"issued an NSA/CSS Intelli gence- 
-Related Incident -Report documenting ! I query of a 

'lX§-_persbn. This report was provided to the NSA/CSS Signals 
"Intelligence Directorate Oversight and Compliance office and the 
NSA'/CSS'Office of the Inspector General. Since the incident 
involved-an active duty sailor, the Navy Criminal Investigative 
Service (NCIS) also opened an investigation. The results of the 
NCIS investigation is" pending. 

(u//Feye£ 


Jaccess to the NSA SIGINT system 


(b) (6) 


started on 4 June 2011. Her accds§ for the. SIG INT syst em was 
revoked on 10 July 2011. She remained at the ! I site until 
August 2011, serving in an administrative position. She returned to 
her home port of San Diego, CA in Aug ust"2011. She is currently 
‘ assigned tatte j [ and does, not have access to 

SIGINT systems. **. 


(U//frOUO) T he OIG initially received information that l I 
l Navy chain of command had conducted an 
investigation into this matter. It was later determined that an 
investigation had not been conducted. The OIG opened its 
investigation after notifying NCIS. 
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(U) Applicable Authorities 

(U) The investigation looked at possible violations of the following 
authorities. See Appendix A for the full citations. 

• (U) Executive Order 12333 United States Intelligence 
Activities 

• (U) United States Signals Intelligence Directive 18 (USSID 
18) 

• (U) DoD Regulation 5240.1-R, Procedures Governing the 
Activities of DoD Intelligence Components that Affect 
United States Persons 

• (U) Standards of Ethical Conduct for the Executive Branch, 
5 C.F.R. §2635.704, Use of Government Property 
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III. (U) FINDINGS 


(U/ /FOU e) Did[ 


_ deliberately and without authorization 

query a U.S. person’s telephone number in the SIGINT system for non-foreign 
intelligence purposes? ‘ 

(U//FOUO) CONCLUSION: Substantiat ed. The preponderance of the 
evidence supports the conclusion tha f] |queried a 

U.S. person’s telephone number in the SlGINT system for non-foreign 
intelligence purposes. Her actions violated Executive Order 1233, USSID 
18, DoD Regulation 5240.1-R, and 5 C.P.R. §2635.704. 


(U) Documentary Evidence 


(b) (3) - P.L. 86- 
(b) (6) 


36 


(U) Agency Training Records 


-(U/7FOU©) Agency -training records show thaf 


successfully completed the Legal Compliance and Minimization 
' Procedures training course (OVSC 1800) on 7 March 2011. This 
course covers, 'in-detail, the rules against targeting United States 
persons. 


(U7 /TOUO) Agency training records also show that| 
successfully completed the Overview of Signals Intelligence 
-Authorities training course (OVSC 1100) on 7 March 2011. 


(U.) NSA/CSS Intelligence-Related Incident Report 


(b)(3) - P.L. 86-36 


(U// fr p U 9) On 4 June 2011 [ 


]made one£ 


database query of a U.S." person’s telephone number. The database 
query requested data from 5-May to 4 June 2011. No results were 
returned is a result of this query. The query did not involve FISA 
data. The query was discovered during a local audit on 9 July 
2011. All information related to this query was purged locally 
(Appendix B).- t 
\ 

(U) United States Navy non-punitive counseling record 


1 


(UZ /TOUOj ] 


Jvlavy supervisor at| (issued 


non-punitive, corrective counseling letter to her on 12 September 
2011 for conducting an “unauthorized database query on an NS A 
system” (Appendix C). 
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(U) Testimonial Evidence 


(U/ /FQUQ) Petty Officer[ 


] 


(u//F euo) [ 


]u.S.-Navy, was interviewed on 15 


August 2013 regarding the allegation that she had misused a U.S. 
SIGINT systenvto targe t a U.S. person for non-foreign intelligence 
purposes. Special Agent l | Naval Criminal 

Investigative Service,(NCIS) also participated in the interview. 

The interview was conducted in NCIS spaces, 3'405. Welles Street, 
San Diego, C Aj K vaived her right to couhselbefore 

the interview, 
testimony./' 


Jprcvided the following sworn 


1(b) (6) 


(b)(3) - P.L. 86-36 


I: 


I 




... | is -currently assigned to thi 
] San Diego, CA. 


(b) (3) 
(b) (6) 


- P.L. 86-36 


•>' • I went TDY to NSA in approximately 

•'ir February .20 T1 to receive tra ining-on die use of SIGINT systems 
; .before being deployed to t he | | 

|\ \ p rogram. The training consisted of one 

poWer point presentation after another. She learned that a U. S. 
person could not be targeted through SIGINT, unless there was a 
/ .. legitimate reason and permission was received from management. 


was deployed to United States Forces - Iraq as 
part Of th e! [ program from 4 June to August 2011. The only 

collection System she recalled having access to was ANCHORY. 


(U//FOUO) On abobt.5 June 201 if 


_was being trained 

on the SIGINT collection system by a U.S. Army enlisted soldier. 

• She could not recall thi s soldi'er’.s name. The soldier trained all new 
\ arrivals for the | Tp rogram. The soldier was standing behind 
‘her while she received step-by-step training on the system. As 
training progressed, she typed in the telephofte.number of a cellular 
telephone that belonged to her boyfriend’s son. if was her decision 
to input this particular telephone number into the collection 

system. The number was to a pre-paid phone purchased at a -. _ 

Walmart in S an Diego, CA. In addition to her boyfriend’s son j | 
I b oyfriend, her daughter and her sister also used this 

pre-paid phone. She inputted the number into the SIGINT system 
because it was the only telephone number she could think of at the 
time. She could not explain why this telephone number came to 
mind instead of her own telephone number or any other number. 
The training also required her to put in search parameters and she 
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(b)(3) - P.L. 86-36 




(b)(3) - P.L. 86-36 
(b) (6) 


selected 5 May to 4 June 2011. She was then told to move on to 
another computer screen and keyboard and did so without clearing 
the telephone number and dates she had already entered. At some 
point she pressed the “enter” key on the second keyboard and both 
monitor screens displayed a bright red warning sign. She saw 
nothing more than the bright red screens after pressing the “enter” 
key. She did not see any data related to her query and did not know 
if actual telephone calling data was displayed as a result of her 
query. She became panicked and asked her training officer what 
had just happened. She was told not to worry and to clear out the 
various fields she had filled in and to clear both screens. She 
thought her training officer would report this incident, but he did 
not. She did not report this incident to her management. 


-(U//TQUO) In app roximate ly August 2011 J | was 

'asked to meet with ] | managers after-she had completed a 
shift.'She was asked if she had eyer iriisused the collection system 
, and, after sorrie thought* recalled making the query on the cellular 
phone belonging to her boyfriend's son. She explained to her 
management'that the incident involv ed a train ing mistake. 
However, she was removed from the ]- -. ~| col lection unit and 
reassigned to JF.STR headquarters, which was in a differe nt 
building. She spent the remainder of her detail at l I 

headquarters. She was required to conduct a one-time training 
course on the proper use of the SIGINT systems as part of non- 
.punitive counseling. She completed the training in September 
2011. She was m?t allowed back into the collection site or given 
access to the SIGINT system. She departed Iraq in October 2011 

and returned, to San Diego, CA. 

* * 


(u/ /rouo£ 


]did not know why she was not allowed 


to access the SIGINT systems after explaining to her management 
that her targeting of a U.S. person was the result of a training 
accident She did not know why there have not been other 
instances of similar training ac cidents b ecause the same U.S. Army 
enlisted person trained all new | ~~| arrivals. After making the 
query on the telephone belonging to her boyfriend’s son, she made 
no further mistakes by targeting U.S. persons. She swore that her 
actions were merely a training mistake. She denied intentionally 
targeting the telephone belonging to her boyfriend’s son. 
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(U) Analysis and Conclusion 

(U/ /FOUO) By her own admission, ! h vas trained on 

the prop er use of NSA SIGINT systems before deploying to the 

I - - - 1 detachment. Age ncy records-document this training was 
given to | | before her deployment. 

(U//FOU0}-Despite this tfaining |~ I conducted a query 

on a telephone number belonging td a U.S. person. Her actions 
were discovered.through a local audit of the SIGINT system on 9 
July-2011 and'documented in theNSA//CSS Intelligence-Related 
Incident report. 


(b)(3) - P.L. 86-36 
(b) (6) 


(U// T.QIJ0 j On several occasion s! l admitted to 

'officials that she had entered the telephone number of a U.S. 
person into the SIGINT system and made a query on that telephone 
number. Her admissions are documented on the 12 September 
2011 Navy counseling letter and during her interview with the OIG 
and NCIS on 15 August 2013. 

(U/ /FOUO~) 1 | has attempted to minimize her actions 

,by saying her unauthorized query of a U.S. person was the result of 
a-training accident. Her argument does not change the facts that 
she had been trained on the proper use of the SIGINT system 
before' deployment, entered the specific telephone number of a 
U.S. person into the SIGINT system, and conducted a query of a 
U.S. person Without proper authorization. 


(U/ /FOUQ) Based upon the p reponderance of the evidence, we 

conclude that[_Iconducted a query of a U. S. person’s 

telephone number in the U.S. SIGINT system for a non¬ 
intelligence purpose. 
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V. (U) RESPONSE TO TENTATIVE CONCLUSION 


(b)(3) - P.L. 86-36 
(b) (6) 


(U// FOUQ) Tentative conclusions were not sent tc | 

She no longer has access to NSA SIGTNT systems and is not under 
NSA command authority. 
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VI. (U) CONCLUSION 


(UZ/TOUfr) Bas ed upon the preponderance of the evidence, the OIG concluded that 
| d eliberately and without authorization queried a telephone number 

belonging to a U.S. person. Her actions violated Executive Order 12333, USSID 18, 

5 C.F.R; §2635.704, and Department of Defense Regulation 5240.1-R, Procedures 2 

6 14. 


(b)(3) - P.L. 86-36 
(b) (6) 
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Senior Investigator 

|(b) (3) - P.L. 86 — 361 


Assistant Inspector General for Investigations 
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Appendix A - Applicable Authorities 


(U) Executive Order 12333 United States Intelligence Activities 
(U) Part 1, 1.7 Intelligence Community Elements.... 

c. The NATIONAL SECURITY AGENCY. The Director of the National Security 
Agency shall: 

(1) Collect (including through clandestine means), process, analyze, produce, and 
disseminate signals intelligence information and data for foreign intelligence and 
counterintelligence purposes to support national and departmental missions; 

(2) Establish and operate an effective unified organization for signals intelligence 
activities, except for the delegation of operational control over certain operations 
that are conducted through other elements of the Intelligence Community. No 
other department or agency may engage in signals intelligence activities except 
pursuant to a delegation by the Secretary of Defense, after coordination with the 
Director; 

(3) Control signals intelligence collection and processing activities, including 
assignment of resources to an appropriate agent for such periods and tasks as 
required for the direct support of military commanders; 

(4) Conduct administrative and technical support activities within and outside the 
United States as necessary for cover arrangements; 

(5) Provide signals intelligence support for national and departmental 
requirements and for the conduct of military operations; 

(6) Act as the National Manager for National Security Systems as established in 
law and policy, and in this capacity be responsible to the Secretary of Defense and 
to the Director; 

(7) Prescribe, consistent with section 102A(g) of the Act, within its field of 
authorized operations, security regulations covering operating practices, including 
the transmission, handling, and distribution of signals intelligence and 
communications security material within and among the elements under control of 
the Director of the National Security Agency, and exercise the necessaiy 
supervisory control to ensure compliance with the regulations; and 

(8) Conduct foreign cryptologic liaison relationships in accordance with sections 
1.3(b)(4), 1.7(a)(6), and 1.10(i) of this order. 


(U) Part 2, 2.3 Collection of Information. Elements of the Intelligence Community are 
authorized to collect, retain, or disseminate information concerning United States persons 
only in accordance with procedures established by the head of the Intelligence 
Community element concerned or by the head of a department containing such element 
and approved by the Attorney General, consistent with the authorities provided by Part 1 
of this order, after consultation with the Director... 
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(U) United States Signals Intelligence Directive (USSID 18) 

(U) Section 3 - Policy, 3.1. The policy of the USSS is to TARGET or COLLECT only 
FOREIGN COMMUNICATIONS. The USSS will not intentionally COLLECT 
communications to, from or about U.S. PERSONS or persons or entities in the U.S. 
except as set forth in this USSID. If the USSS inadvertently collects such 
communications, it will process, retain and disseminate them only in accordance with the 
USSID. 

(U) Section 4 - Collection, 4.1. (S-CCO) Communications which are known to be to, 
from or about a U.S. person or non-diplomatically immune visitor to the U.S. will not be 
intentionally intercepted, or selected through the use of a selection term... 

(U) DoD Regulation 5240.1-R, Procedures Governing the Activities of DoD Intelligence 
Components that Affect United States Persons 

(U) Procedure 2 - Collection of Information About United States Persons, C. Information 
that identifies a United States person may be collected by a DoD intelligence component 
only if it is necessary to the conduct of a function assigned the collection component, and 
only if it falls within one of the following categories... 

(U) Procedure 14- Employee Conduct, B.l. Employee Responsibilities. Employees shall 
conduct intelligence activities only pursuant to, and in accordance with, Executive Order 
12333 and the Regulation. In conducting such activities, employees shall not exceed the 
authorities granted the employing DoD intelligence components by law; Executive Order, 
including EO 12333, and applicable DoD directives. 

(U) Standards of Ethical Conduct for the Executive Branch, Title 5, Code of Federal 
Regulations, §2635.704 Use of Government Property 

(U) (a) Standard. An employee has a duty to protect and preserve Government property 
and shall not use such property, or allow its use, for other than authorized purposes. 

(U) Title 18, United States Code, § 2511 - Interception and disclosure of wire, oral, or electronic 
communications prohibited. 

(U) (1) Except as otherwise specifically provided in this chapter any person who (a) 
Intentionally intercepts, endeavors to intercept, or procures any other person to intercept 
or endeavor to intercept, any wire, oral, or electronic communication; (b) Intentionally 
uses, endeavors to use, or procures any other person to use or endeavor to use any 
electronic, mechanical, or other device to intercept any oral communication; Shall be 
punished as provided in subsection (4) or shall be subject to suit as provided in 
subsection (5). 
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APPENDIX B 

NSA/CSS INTELLIGENCE-RELATED INCIDENT REPORT 
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COUNSELING LETTER 
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Iff**, 


M 


DETAILED REASON FOR COUNSELING: 

This corrective counseling is being administered tcj 
should NOT be viewed upon as a punitive action. 


to correct a deficiency and 


On June 5,2011 J I conducted an unauthorized database query on an NSA system. 

Her actions, although not found to' be malicious or intentional, were in violation of Executive Order 12333 
(Section 2.3), Department of Defense (DoD) Regulation 5240.1-R (Chapter 2, Paragraph C2.3.1; Chapter 5, 
Paragraph C5.3.3.1/C5.3.3.2/C5.3.3.2.1; Chapter-5,, Paragraphs C5.6 through C5.6.2.3), and Army 
Regulation (AR) 318-10. ' * •. 

_ » _ * 

It is the intent of this counseling to mak d b ware of the violations, to reinforce the 

importance of the above mentioned regulations, and to emphasize .her responsibility tp the United States 
government while conducting the SIGINT mission. **-.**•. 


OTHER AGENCIES INDIVIDUAL REFERRED TO FOR COUNSELING: 


(b) (3) 
(b) (6) 


P.L. 86-361 



ft 


SOLUTION DEVELOPED 
INVOLVEMENT: 


TO OVERCOME PROBLEM AND PR EC LLD ^FURTHER 

* * • 


[ acknowledged her negligence and that she ha s a responsibility t o adhtfe to ALL 
directives that govern h er access to these safe guarded systems. I ,' k vill coordinate with 

l and complete ALL ann ual Information Assurance training by COB 11SEP05. 
Furthermore,’she will coordinate wjth | ~| leadership, create-framing slides, schedule a trainin g site, and 

conduct framing-on the above mentioned, 1 Violations and USSID 18 (USS1D SP0018) for | ~| 
Detachment personnel on VBC. This training is to be completed by COB on 11 SEP 10. ,' 


INDIVIDUALS RESPONSE TO THIS COUNSELING SESSION: 









Doc ID: 6595176 







RECORD OF COUNSELING 
NASW 1510-45 {REV 8-01) 


INSTRUC TIONS FOR TIIK COMPLETION OK THIS FORM 


1. The counseling session should be in private and should respect the rights of the individual. 

2. The statement, upon completion, should be reviewed very carefully in order to ensure counseiee understands all comments. 

3. Provide counseiee a copy of this report if hc/shc so desires. 

4. Ensure report is filed with Division Oflicet’s Notebook in a locked desk or safe 



PRIVACY ACT STATEMENT 


Authorization to request the information in this form ns derived from United Stales Code 301. Departmental regulations. Purpose of 
^ v J S t ^ pr0V,d l^ DlvlsKln ° fficct wl * rcadi| y accessible data concerning personnel in his/her division. The information is 
used by the Division Officer to manage and administer his/her personnel, and to take necessary actions regarding satisfactory or 
unsatisfactory performance. Disclosure of the following items of information is voluntary. The individual being documented has the 
nght to etamme and copy this documentation related to him/her, have the right to review and discuss the issues m order to resolve 
there; have the nght to request amendments to, or modification of, this document. Any statement made can and may be used against 
him/her in a court oflaw. - ^ 


01SEP11 


DATE 


01SEP11 


COnNSJTTF S RAIL & NAME 


DATE 




WUHSH^R'SkATEANAMK.. 


J signature" 


di sent 




REASON FOR COUNSELING SESSION j(b) (3) - P.L. 86-36| 

[NOTE: Insert (P) for Positive, (N) for Negative or fl) for Informative ] 1 - 1 

— PROFESSIONAL KNOWLEDGE: 

TECHNICAL KNOWLEDGE & APPLICATION 
CAREER RESPONSIBILITY 


QUALITY OF WORK: 

STANDARD OF WORK; VALUE OF END PRODUCT 


JOB ACCOMPLISHMENT/INITIATIVE: 

RESPONSIBILITY & QUALITY OF WORK 
ON THE JOB TRAINING PROGRESS 

- TEAMWORK: 

CONTRIBUT IONS TO TEAM BUILDING & TEAM RESULTS 


EQUAL OPPORTUNITY: JL 

FAIRNESS; RESPECT FOR HUMAN WORTH 
DOMESTIC & DEPENDENT RESPONSIBILITY 

MILITARY BEARING/CHARACTER: JL 

ADHERENCE TO NAVY CORE VALUES CONDUCT 
DRESS & APPEARANCE: PHYSICAL FITNESS 


LEADERSHIP: 

ORGANIZING. MOTIVATING AND DEVELOPING OTHERS' 
PERFORMANCE 

OTHER: 

INDEBTEDNESS, COMMUNITY CONFI.ICT.F.TC 


'joTwm, 
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